WO2019053357A1

WO2019053357A1 - Method for optimising a vehicle speed indicator parameter intended for the steering assistance functions and the safety functions

Info

Publication number: WO2019053357A1
Application number: PCT/FR2018/052191
Authority: WO
Inventors: Olivier BARRY; Luc LEYDIER; Romain MORETTI
Original assignee: Jtekt Europe
Priority date: 2017-09-15
Filing date: 2018-09-07
Publication date: 2019-03-21
Also published as: US10994771B2; FR3071219A1; DE112018005154T5; JP2020533237A; CN111356625A; US20200216114A1; JP7317806B2; BR112020004886A2; FR3071219B1; CN111356625B

Abstract

The invention concerns a method for managing an assisted steering system (1) for a vehicle, said assisted steering system including at least one assistance function (F1) intended to help a driver drive the vehicle and at least one safety function (F2) intended to give said assistance function a predetermined ASIL level as defined by the ISO-26262 standard, said assistance function and said safety function each making use of a vehicle speed indicator parameter (V_param), said method comprising a step (a) of estimating a functional speed (V_func) representative of the actual longitudinal speed of the vehicle, used by default as the vehicle speed indicator parameter (V_param), a step (b) of estimating a speed upper bound (V_upper), a step (c) of calculating an underestimated speed (V_under) resulting from the application, to the speed upper bound (V_upper), of a reduction value (V_reduc) derived from a reduction law (LR), and, if the functional speed (V_func) is lower than the underestimated speed (V_under), a step (e) of switching in which the underestimated speed (V_under) is substituted for the functional speed (V_func) as the vehicle speed indicator parameter (V_param).

Description

Method of optimizing a vehicle speed indicator parameter for steering assistance functions and security functions

The present invention relates to methods for managing power steering systems for vehicles.

It is known to integrate in such steering systems on the one hand assistance functions, which are intended to assist a driver in steering the vehicle, either by providing a manual steering assistance effort, or by ensuring a true automatic control of the vehicle by servocontrolling the trajectory of said vehicle (for example for automatic parking, called "park assist", or maintenance in a lane keeping traffic lane), and secondly security functions, intended to confer on the system, and more particularly on the assistance functions, a sufficient level of security and reliability.

For this purpose, the safety standard ISO-26262 proposes to define, from a risk analysis, "ASIL" ("Automotive Safety Integrity Level") safety levels, rated from the lowest to the most demanding, " QM "(" Quality Management ", that is to say not relevant for safety), then" A "," B "," C "and finally" D ", and which are determined by characterizing each dangerous situation ( or "dreaded event") possible by three parameters:

- its severity, that is the degree of severity of the injuries that may be inflicted on the occupant of the vehicle (from S0 for the absence of injury to S3 for a critical or fatal injury); its exposure, that is to say the foreseeable frequency of occurrence of operating conditions in which an injury is likely to occur (from a near-zero probability E0, or very low El, that the injury does not occur only in rare operating conditions, up to a high probability E4, in which it is almost certain that an injury will occur in the majority of operating conditions), and - its controllability, ie the probability that the driver, or the system, can act (or react) to control the situation and avoid the injury (from a generally controllable situation C0 to a situation difficult to control or even completely uncontrollable C3). The ASIL level depends on the combination (of the product) of these three parameters. Thus, for example, a dangerous event causing critical injuries S3, with a high probability of occurrence E4, and uncontrollable C3, will fall under level ASIL D (the highest).

On the other hand, the same C3 uncontrollable event causing S3 critical injuries, but having a lower probability of occurrence, one or more degree (s) lower than the maximum degree, will have its ASIL level lowered by one or more degrees by result. In this example, the ASIL level will thus be reduced to C in the case of an exposure E3, or even to A in the case of an exposure El.

In practice, the assistance functions and the security functions generally use, among their input data, an estimation of the instantaneous longitudinal speed of the vehicle.

However, during phases called "dynamic" longitudinal acceleration or longitudinal deceleration (braking) of the vehicle, the speed can sometimes be temporarily overestimated or underestimated.

This can especially be the case when the speed is estimated from the measured average speed of rotation of the wheels and that the estimate can therefore be distorted if some wheels are blocked or on the contrary skate and embellish during such phases of sudden acceleration or sudden braking.

For example, a strong pressure on the accelerator can create a loss of adhesion of the driving wheels, which begin to skate and are therefore subject to a significant increase in their rotational speed, without the actual speed of the vehicle increases significantly. The real speed of the vehicle will then be much lower than that estimated from the speed of rotation of the wheels.

Conversely, if the wheels slow down strongly or lock up in an emergency braking situation and lose traction, then the vehicle can slide on the roadway at a real speed much higher than that estimated from the speed of the vehicle. rotation of said wheels.

An overestimation of the vehicle speed may certainly be favorable to the security functions, by allowing said security functions to control the vehicle more strictly, and in particular to make more responsive steering corrections, or to limit the amplitude of the vehicle. steering maneuvers, which are potentially more dangerous at high speeds than at low speeds.

On the other hand, an overestimation of the speed may also result in an undesirable reduction of conventional driving assistance, or a restriction of the booster force that is generated by the management assistance. to recall the steering wheel in the central position after a turn (so-called "street corner recall" function), even though the vehicle is still traveling at a low real speed, typically in the city, and would thus have the utility of such assistance functions and flying reminder. This will result in discomfort for the driver, who will feel a kind of heaviness in the steering wheel and steering system.

Conversely, a random underestimation of the speed of the vehicle will favor the assistance to the maneuver of the steering wheel, but may be detrimental to the reliability and responsiveness of security functions, and may therefore present a risk for the occupants of the vehicle.

One solution could be to use two different vehicle speed evaluations, of different origins, namely a first evaluation for the assistance functions, and the other evaluation, possibly voluntarily overestimated, for the security functions, in order to guarantee both the comfort of the assistance and the security of the different functions of the steering system at satisfactory ASIL levels.

However, such a solution would require redundant equipment, including sensors and processing units, which would increase the cost and size of the steering system.

In addition, and above all, the fact of using distinct speed signals, without correlation with each other, can in particular induce contradictory behaviors, called "interference", respective assistance and security functions, if an overestimate or underestimate error affects one of the two speed signals and not the second.

The objects assigned to the invention therefore aim at overcoming the aforementioned drawbacks and at proposing a new management method for a power steering system which makes it possible to simply and reliably manage the instantaneous speed information and the joint execution of the functions. assistance and security functions that depend on this instantaneous speed information.

Objects assigned to the invention are achieved by means of a method of managing a vehicle power steering system, said power steering system having a plurality of functions including at least one assist function for assisting a driver in the control of the vehicle and at least one security function intended to confer on said assistance function a predetermined ASIL level within the meaning of the ISO-26262 standard, said assistance function and said security function each making use of the same vehicle speed indicator parameter which is considered representative of the longitudinal speed of the vehicle, said method being characterized in that it comprises a step (a) of functional speed estimation, during which a first value of speed, called "functional speed", which is representative of the actual longitudinal speed of the vehicle at a given moment, and which is used by default as a vehicle speed indicator parameter, according to a first mode of operation called "operating mode normal ", a step (b) for estimating a speed increase, during which a second speed value, referred to as a" speed magnifier ", is estimated to be greater than the functional speed and representative of an upper limit. the actual longitudinal speed of the vehicle at the instant considered, a step (c) of calculating an underestimated speed during which ue at the speed boost a predetermined reduction law so as to obtain an underestimated speed value, which is lower than the speed boost of a predetermined reduction value set by said reduction law, a step (d) of comparison during which the functional speed value is compared, in absolute value, with the underestimated speed value, and if the absolute value of the functional speed is less than the absolute value of the underestimated speed, a step (e) switchover during which switching from the normal operating mode to a second mode of operation called "safety mode", substituting the speed of operation underestimated speed as a speed indicator parameter of the vehicle used at the input of each of the assistance and security functions.

Advantageously, such a method makes it possible to promote the use, as a parameter indicating the speed of the vehicle, of the functional speed, which represents an estimate very close to the real speed of the vehicle under normal conditions, and this in order to optimize the behavior of the assistance function or functions, and thus to optimize driving comfort, but on the condition that the value of the functional speed remains acceptable to ensure the proper functioning of the security functions.

In the opposite case, that is to say if the functional speed signal falls below an acceptable threshold, and thus becomes incompatible with the proper functioning of the security functions, then the method provides a substitution signal, namely a signal of underestimated speed, which is determined from a speed increase, by nature higher than the real speed of the vehicle and therefore favorable to said security functions. In other words, the method makes it possible to define, and recalculate in real time, at each instant, and regardless of the real speed of the vehicle, a "safety tunnel", which is between a high value corresponding to the upper limit. speed and a low value corresponding to the underestimated speed, and to ensure that the vehicle speed indicator parameter selected for the application of the assistance and security functions is permanently in said security tunnel, in order to guarantee reliable operation of the security functions.

Thus, as long as the functional speed signal, which generally gives an accurate estimate of the actual instantaneous speed of the vehicle but which is difficult to secure intrinsically because of the complexity of the estimation operation, remains within this security tunnel, said functional speed signal is used as a speed indicator parameter of the vehicle, to promote the accuracy and comfort of the assistance functions, without affecting the reliability of the security functions.

On the other hand, if an error affects said functional speed signal such that said functional speed signal exits (from below) the admissible domain delimited by the safety tunnel, then this functional speed signal is replaced by the secure signal that is the underestimated speed, which corresponds to a low permissible limit of applicability of the security functions. In this way, it ensures the continuity of service of said security functions.

Thus, the method according to the invention makes it possible to automatically select the vehicle speed indicator signal that is most appropriate to the situation at the instant considered, while systematically guaranteeing the reliable operation of the security functions.

Furthermore, the use of a single underestimated speed information as a vehicle speed indicator parameter, i.e. a single speed signal, common to the assistance functions and security functions, advantageously allows to reduce the structure, both hardware and software, of the steering system, and reduce the cost of said system.

Other objects, features and advantages of the invention will appear in more detail on reading the description which follows, and with the aid of the accompanying drawings, provided for purely illustrative and non-limiting purposes, among which:

Figure 1 illustrates a reduction law according to the invention. Figure 2 illustrates, in a block diagram, the operating principle of a method according to the invention within a power steering system.

FIG. 3 illustrates, by means of a graph representing a change over time of the various speed signals used by the method, an instantaneous switching from the normal operating mode to the security mode.

FIG. 4 illustrates, by means of a graph representing a change over time of the different speed signals used by the method, a delayed switching from the normal operating mode to the security mode.

FIGS. 5A and 5B illustrate, by means of graphs representing a change over time of the various speed signals used by the method, the implementation of switching from the security mode to a reinforced security mode, respectively after a first instantaneous switching according to FIG. 3 and after a first delayed commutation according to FIG.

The present invention relates to a method for managing a power steering system 1 for a vehicle.

Such a power steering system 1 preferably comprises, in a manner known per se, a steering wheel intended to be maneuvered by the driver of the vehicle, and which controls, preferably by means of a steering column provided with a pinion, the displacement of a steering mechanism for changing the orientation of one or more steering wheels 2.

Said steering mechanism preferably comprises a rack, which is mounted movable in translation in a steering box fixed to the chassis of the vehicle, on which meshes the pinion, and at the ends of which are fixed steering rods which allow to modify the yaw orientation, i.e. the steering angle, of the rocket carrier carrying the wheels 2.

An assistance motor, preferably electric, is also coupled to the steering mechanism to provide an assist force, typically an assist torque, which facilitates the maneuvering of said steering mechanism and thus the modification of the steering angle. .

The power steering system 1 also comprises a plurality of functions F1, F2, including at least one assistance function F1 designed to assist a driver in the control of the vehicle and at least one security function F2 intended to confer on said function a predetermined ASIL level within the meaning of ISO-26262.

Preferably, the assistance function F1 is chosen from: a manual steering assistance function, intended to provide, by means of the assistance engine, an assistance effort to facilitate the movement of the steering mechanism and / or the steering wheel, said manual steering assistance function being able in particular to be a conventional assistance function, intended to provide an assistance effort to amplify the manual effort provided by the driver to help the driver to turn the wheel, or a reminder function to remind the driver flying to its central position, which corresponds to a straight line trajectory after a turn;

an automatic piloting function, providing an automatic control of the vehicle trajectory, such as a lane keeping function, an automatic obstacle avoidance function, or a parking function automatic ("park assist").

The security function F2, distinct from the assistance function F1, may for example be designed to restrict, when the longitudinal speed of the vehicle increases and / or exceeds a certain threshold, the intensity of the assistance effort determined by the assistance function F1, in order to avoid that the assistance function F1 causes, especially when the vehicle is traveling at a high speed (typically above 50 km / h, 90 km / h or 120 km / h). km / h), abrupt steering movements that could cause the vehicle to lurch at such speeds.

Preferably, the security function F2 guarantees an ASIL level at least equal to B, preferably at least equal to C, or even equal to D in the sense of the ISO-26262 standard.

Thus, we can meet the increasingly stringent requirements imposed by the entry into force of the ISO-26262 standard which now prohibits the absence of ASIL security, that is to say that excludes the level "Quality Management" and impose a higher ASIL level.

The assistance function F1 and the safety function F2 each use the same vehicle speed indicator parameter V_param which is considered as representative of the longitudinal speed of the vehicle, as can be seen in FIG. 2.

In other words, each of said functions F1, F2 requires, for its own execution, the knowledge of a speed information, representative of the longitudinal velocity of the vehicle, said speed information being provided here at the input of each of said functions F1, F2 in the form of a signal called "speed indicator parameter" V_param.

According to the invention, the method therefore comprises a functional speed estimation step (a), during which a first speed value, called "functional speed" V_func, is estimated, which is representative of the real longitudinal speed of the vehicle at a moment considered.

This functional speed V_func is used by default as a speed indicator parameter of the vehicle V_param, according to a first operating mode called "normal operating mode".

In practice, this functional speed V_func will, in normal operation, that is to say in the absence of wheel slip and in the absence of hardware failure of a sensor or a calculator responsible for estimating said functional V_func, equal to the actual speed of the vehicle to +/- 10%, or even +/- 5%, that is to say, will have a very good accuracy.

This functional speed signal V_func will therefore be ideal for the application of the assistance functions Fl.

On the other hand, the functional speed signal V_func may be relatively sensitive to the disturbances or failures that affect the vehicle or the calculation of said signal, so that its ASIL (guaranteed) level may be low.

In particular, this functional speed V_func may tend to be slightly underestimated, which is, in certain situations, not acceptable for the security functions F2.

According to one possible implementation, the functional speed information V_func can come from a third party system, which is on board the vehicle but which is separate from the power steering system 1, such as for example an electronic stability program ( "Electronic Stability Program") or Anti-Locking System ("AntiBlocking System"). The functional speed V_func will then be part of the information available on the on-board network 20, of the CAN ("Controller Area Network") or FlexRay (computer bus) type, and may be retrieved by the power steering system 1 during the step (at).

According to another possible implementation, the estimation of the functional speed V_func can be carried out by the power steering system 1 itself, for example from measurements of the rotational speed V_roue of one or more wheels 2 of the vehicle, as shown in Figure 2. For example, the average speed of rotation of the wheels 2 of the vehicle, typically the average speed of rotation of two wheels 2 or four wheels 2, converted into linear speed, taking into account in particular the diameter, may be considered as the functional speed V_func. said wheels (including the tires).

More particularly, it may be possible to consider the average speed of rotation of the non-driving wheels of said vehicle (when the vehicle does not operate with an integral transmission), in particular in order to limit the estimation errors related to possible losses of adhesion of driving wheels due to acceleration or braking.

Alternatively, one could of course consider the average speed of rotation of all the wheels, motor and / or non-motor vehicle.

According to the invention, the method also comprises a step (b) for estimating a speed enhancer, during which a second speed value, called "velocity magnifier" V_upper, is estimated which is distinct from, and greater than, the functional speed V_func and which is representative of an increase of the real longitudinal speed of the vehicle at said instant.

This speed increaser V_upper represents an upper speed limit, that is to say a longitudinal speed value which is known to be not less than the value of the real longitudinal speed of the vehicle at the instant considered. .

In other words, it is estimated that the speed increaser V_upper so that one is assured, given the life situation of the vehicle, that materially, at the moment considered, the actual longitudinal speed of the vehicle is at most equal to, and potentially lower than, said estimated V_upper speed increaser, so that it is therefore impossible for the vehicle to actually travel faster than this value of speed increaser V_upper.

As an indication, the speed increaser V_upper will preferably be higher (in absolute value) than the real longitudinal speed of the vehicle with a value between 0 km / h and 30 km / h.

In addition, the V_upper speed master signal will be intrinsically "secure" in that it will have an ASIL level higher than that of the functional speed signal V_func.

As well as the functional speed information V_func, the V_upper speed increaser information can be retrieved from the on-board network 20, from third-party embedded systems such as ESP or ABS, or be determined by the power steering system 1 itself.

In this respect, it is possible, for example, to evaluate the speed increaser V_upper from the maximum rotational speed V_roue observed among the set of each of the rotational speeds of the driving wheels 2 of the vehicle.

Thus, a "high" estimate, or even an overestimation, of the actual instantaneous speed of the vehicle is preferred, in order to have a V_upper speed increaser which will eliminate any risk of using as parameter speed parameter V_param a value per too underestimated that could distort the execution of the F2 security function.

It will be noted in this respect that the fact of taking into consideration the maximum rotational speed V_roue of the wheel 2 which rotates the fastest, and of basing the estimate of the speed increaser V_upper on said maximum wheel rotation speed, makes it possible to ensure that such an amount is actually determined.

The method then comprises a step (c) for calculating an underestimated speed during which a predetermined reduction law LR is applied to the speed increaser V_upper so as to obtain an underestimated speed value V_under, which is lower than the speed increaser V_upper of a predetermined reduction value V_reduc fixed by said reduction law LR:

| V_under | = | V_upper | - | V_reduc | .

It should be noted that the concept of "reduction" or "underestimation" of the speed of the vehicle consists in reducing, in absolute value, the speed increaser V_upper initially estimated to obtain an underestimated speed V_under which is, in value absolute, closer to zero (closer to a zero velocity) than said velocity enhancer V_under.

As will be detailed below, and as illustrated in FIGS. 3 and 4, the reduction value V_under is chosen so that it defines, with respect to the V_upper speed increaser, the width of a "tunnel" ST, which is comprised between a high value corresponding to the V_upper speed increaser and a low value corresponding to the underestimated speed V_under, and wherein said underestimated speed corresponds to a minimum admissible value to guarantee the correct operation of the security function F2.

The reduction value (value of underestimate) V_reduced which results from the application of the law of reduction LR is advantageously sufficient to allow, even to favor, an appropriate execution of the function of assistance Fl, so as not to be source of discomfort for the driver, but nevertheless weak enough in order not to reduce too much the speed estimation used as parameter indicating the vehicle speed V_param, and thus not to compromise the reliable execution of the security function F2, and thus to guarantee that said security function F2 and the system Assisted steering systems 1 operate at the desired ASIL level.

Thus, as long as the value taken by the vehicle speed indicator parameter V_param selected for the application of the assistance functions F1 and F2 security will be inside said security tunnel ST, will ensure an acceptable operation of two types of functions, and in particular an acceptable operation of the security function F2.

The method then comprises a comparison step (d) in which the functional speed value V_func is compared, in absolute value, with the underestimated speed value V_under, and, if the absolute value of the functional speed | V_func | is less than the absolute value of the underestimated speed | V_under | , a switching step (e) during which switching from the normal operating mode to a second operating mode called "safety mode", substituting for the functional speed V_func the underrated speed V_under as indicating parameter V_param vehicle speed used as input to each of the assistance functions Fl and F2 securing.

This corrective switching makes it possible to selectively assign to the speed indicator parameter of the vehicle V_param sometimes the functional speed value V_func, as long as said functional speed value is, in absolute value, greater than or equal to the underestimated speed V_under, c ' that is to say, as long as said functional speed value remains in the safety tunnel ST acceptable for the security function F2, and sometimes the underestimated speed value, that is to say the acceptable lower limit of the tunnel ST security, when the value of the functional speed falls below said acceptable lower limit V_under.

Thus, the vehicle speed indicator parameter V_param is permanently (or almost permanently) maintained above the low lower limit V_under of the security tunnel, which guarantees the proper functioning of the security function F2.

In addition, the switching occurs only when the functional speed V_func is too low and crosses the lower limit set by the underestimated speed V_under, that is to say only in case of error of estimation or failure, of so that, in the absence of error or failure, the functional speed signal V_func is preferred which is a more accurate and realistic estimate the actual longitudinal speed of the vehicle than the speed increaser V_upper and / or the underestimated speed V_under, and this so as to promote, in normal operation, the reliability and comfort of the assistance function Fl.

By default, that is to say, as long as the functional speed V_func is in the security tunnel ST, or respectively when the functional speed V_func returns in the security tunnel ST, it remains, respectively rebas, in the mode normal operation.

Of course, the method also comprises a shared use step during which the same vehicle speed indicator parameter V_param, equal to either the functional speed V_func or the underrated value V_under, is used, such as input of each of the aforementioned assistance functions F1 and F2.

The reduction law LR is preferably established beforehand, by tests and / or simulations in which, at a given real longitudinal speed, not zero, of the vehicle, the indicator parameter is progressively lowered, and artificially, in absolute value. of the vehicle V_param which is taken into consideration by the assistance functions Fl and F2 securing, and the corresponding reactions of the F2 and / or the vehicle security function are observed, until a low threshold of speed indicator parameter V_param_thresh_low from which it can be seen that the security function F2 no longer manages to ensure a security in accordance with the desired ASIL level at the given real longitudinal speed, and then, from this low indicator parameter threshold, it is fixed. velocity V_param_thresh_low, a reduction value V_reduc retained for the law of reduction LR.

In particular, the reduction value can be determined

V_reduc from the difference, called "maximum permissible reduction value" V_reduc_max, between firstly the functional speed V_func, or more preferably the speed increaser V_upper, at the moment when one reaches the low threshold of parameter indicator of speed V_param_thresh_low, and secondly said low threshold speed parameter parameter V_param_thresh_low, that is to say:

V_reduc = f (V_reduc_max)

with I V_reduc_max | = | V_upper | - | V_param_thresh_low | It should be noted that, in practice, it is possible to carry out the tests intended to determine the law of reduction LR under stabilized conditions, in which it is possible to trust the V_func functional speed value. So we can calmly use the first formula above:

This being so, under stabilized conditions, the functional velocity value V_func is generally very close to the velocity magnifier V_upper, so that the two methods (corresponding to each of the two formulas specified above) give, as a first approximation, results substantially identical.

We can then choose

V_reduc = V_reduc_max,

or, preferably, in order to maintain an extra margin of safety, define the reduction value V_reduc as a fraction of the maximum permissible reduction value V_reduc_max, for example:

0.70 * I V_reduc_max | ≤ | V_reduc | ≤ | V_reduc_max | .

said fraction being even more preferably comprised (in absolute value) between 70% and 90% of the maximum allowable reduction value V_reduc_max:

0.70 * | V_reduc_max | ≤ | V_reduc | ≤ 0,90 * | V_reduc_max | . In other words, the reduction law LR is empirically constructed by operating the power steering system 1, and more generally the vehicle, at a given real speed, and therefore at a given speed boost V_upper, and by successively testing several decreasing values of the speed parameter parameter V_param (in absolute value), that is to say intentionally distorting the speed indicator parameter V_param, in order to simulate increasing defects in the estimation of the functional speed V_func which, in the absence of corrective switching specific to the invention, would induce an increasingly significant underestimation of said functional speed V_func and therefore of the indicator parameter V_param, until a low threshold of speed indicator parameter V_param_thresh_low which causes a failure of the security function F2, for example by rendering the security function inoperative or incapable of to compensate a dangerous event in time (feared event).

Thus, for each real longitudinal speed, and therefore for each corresponding V_upper speed increaser, a maximum allowable reduction value V_reduc_max is identified from which, if said maximum allowable reduction value V_reduc_max is deduced from said V_upper speed increaser, to calculate the V_param speed parameter parameter used by the F2 security function, the induced fault degrades the performance of the function sufficiently securing F2 so that said function is "downgraded" to an ASIL level lower than the ASIL level required by the specifications.

The low speed parameter threshold V_param_thresh_low, ie the underestimate limit which causes the failure of the security function F2, therefore corresponds empirically to the maximum acceptable reduction value which should not be exceeded. not exceed (in absolute value), a given V_upper speed boost, and therefore in practice when one is at a given real speed, to maintain reliable security at the desired ASIL level.

The test is repeated for several (increasing) values of the real longitudinal speed of the vehicle, and therefore for several values of V_upper speed increaser (respectively for several functional speed values V_func), so as to preferably cover the entire range of use. predictable vehicle, typically from 0 km / h to at least 130 km / h, 150 km / h, 200 km / h or even 250 km / h.

The set of data series that associates with each actual speed value, or, more preferably, each value of speed increaser V_upper, in the aforementioned speed range (here from 0 km / h to 250 km / h on 1), a reduction value V_reduc (maximum acceptable), and therefore an acceptable minimum (the lowest acceptable value, in absolute value) of the underestimated speed V_under, forms the reduction law LR.

The parameter speed indicator V_param can therefore take, without risk for the security function F2, any value which will be in the range defined between on the one hand a high limit value equal to the speed increaser V_upper, and on the other hand, and above all, a low limit value equal to the underestimated speed V_under, that is to say equal to the speed increaser V_upper (considered at the instant considered) minus the reduction value V_reduc applicable at the instant considered. .

In absolute terms, it could be envisaged, according to one embodiment, to use the same constant reduction value V_reduc regardless of the actual instantaneous speed, and therefore regardless of the value of the speed increaser V_upper.

It will be possible in particular to use such a constant reduction V_reduc reduction value ("retrofit") within systems of assisted steering 1 of older generation, whose F2 security functions are relatively insensitive to the underestimation of speed.

By way of example, said constant reduction value V_reduc can then be equal to a constant value chosen in the range between 30 km / h and 40 km / h. However, according to another particularly preferred embodiment, the reduction law LR adjusts the reduction value V_reduc according to the estimated V_upper speed.

Advantageously, the fact of modifying the reduction value V_reduc as a function of the speed allows a particularly fine use of the principle of underestimation according to the invention, which notably makes it possible to apply the method to F2 security functions of new generation, which are more efficient but more demanding because they are more sensitive to speed underestimation faults than previous generation security functions.

The safety of the vehicle and its occupants is therefore improved.

Even more preferably, the reduction law LR is generally an increasing function, so as to increase, in absolute value, the reduction value V_reduc when the V_upper speed increaser increases in absolute value, as illustrated in FIG. figure 1.

Thus, the speed of the vehicle can be further underestimated when the vehicle is traveling at high speeds than when the vehicle is traveling at low speed, or, otherwise formulated, it is possible to apply an underestimate at low speed (reduction value V_reduc) which is less than the underestimation applied at high speed.

It will be noted that the form of evolution of the reduction value V_reduc proposed in FIG. 1 is only one variant among others, said evolution being mainly defined as a function of the behavior of the security function or functions F2 concerned.

In the example of FIG. 1, the security functions F2 can behave very differently between a parking situation (or a very low speed situation, typically less than 10 km / h or even 5 km / h), in which said F2 security functions are relatively "loose" and not very constraining, and a situation of beginning of rolling (typically between 5 km / and 30 km / h), in which said F2 security functions become more restrictive and therefore more sensitive to variations of the V_param speed indicator parameter.

In order to avoid large variations in the behavior of said low speed F2 securing functions, the allowable reduction value V_reduc is decreased when the vehicle speed approaches zero.

Then, typically between 30 km / h and 160 km / h, the behavior of F2 security functions preferably evolves more gradually, which is why we can predict a reduction value V_reduc almost constant. For very high speeds (above 160 km / h or even more than 200 km / h), the behavior, and in particular the triggering thresholds, of the F2 security functions preferably do not change which explains that one can tolerate a rather large underestimation of the speed, and therefore relatively low reduction values V_reduc.

In this way, the possible underestimation of the speed indicator parameter V_param does not distort the perception, by the power steering system 1, of the real speed of the vehicle, and one thus preserves an execution of the functions, both of the Fl assistance function of the F2 security function, perfectly adapted to the actual speed of the vehicle.

Advantageously, the reduction value V_reduc will be chosen so as on the one hand to spare the sensitivity of the security functions F2, to avoid erratic behavior of the latter, but also, on the other hand, so, when the vehicle speed indicator parameter V_param switches to the underestimated value V_under while the vehicle is traveling at low speed, does not disable or does not restrict too early certain Fl assistance functions which are particularly useful when the vehicle is traveling at low speed in built-up areas, particularly when the vehicle uses traffic lanes with intersections and sharp turns (such as "street corners").

More particularly, it is thus possible to retain, for example, despite the passage in secure mode, a call assistance function in the center of the steering wheel which remains effectively active over the entire real speed range concerned, here preferably between 0 km / h and 50 km / h, and therefore remains active as long as the vehicle is driven in the city and requires ample maneuvering of the steering wheel to turn at street corners.

According to an exemplary implementation, purely indicative and non-limiting, the reduction law LR may comprise several domains, as illustrated in FIG.

a first low speed domain D1, between 0 km / h and a low speed limit VI between 20 km / h and 50 km / h, and preferably equal to 30 km / h, this Dl domain corresponding to the situations access to parking and city traffic. In said first domain D1, the reduction law LR will preferably be continuously increasing, so as to progressively increase the reduction value V_reduc applicable with the speed increaser V_upper; the reduction value V_reduc applicable may typically be between 0 km / h and 8 km / h at 10 km / h (value reached at speed limit VI);

a second range D2 of medium speed, between the low speed limit VI mentioned above (30 km / h in Figure 1) and a high speed limit V2 preferably between 130 km / h and

180 km / h, and for example equal to 160 km / h in FIG. 1, said second domain D 2 thus typically corresponding to the traffic outside the built-up area and on the motorway. In this second domain D2, the reduction value V_reduc will follow a substantially plateau evolution, and will therefore preferably be constant, even slightly increasing, and for example between 8 km / h at 10 km / h and 15 km / h, or even equal to 10 km / h;

a third high speed domain D3, between the aforementioned high speed limit V2 (160 km / h in FIG. 1) and a very high speed limit V3 preferably between 180 km / h and 250 km / h, and for example, equal to 200 km / h in FIG. 1, third domain D3 in which the reduction value V_reduc increases continuously with the speed increaser V_upper, according to a preferably more strongly increasing function than in the first domain D1, to reach a value between 20 km / h or 25 km / h and 40 km / h, and for example equal here to 30 km / h; possibly a fourth domain D4 of very high speed, between the very high speed limit V3 mentioned above (200 km / h in FIG. 1) and the maximum speed V4 of the vehicle (for example 240 km / h or 250 km / h) , in which the underestimation will preferably be constant, or slightly increasing, for example here equal to 30 km / h.

The law of reduction LR can of course take a very different form depending on the nature of the security functions F2 concerned.

Preferably, the reduction law LR is stored in a nonvolatile memory in the form of a predetermined abacus which, as illustrated in FIG. 1, associates with each value of the speed increaser V_upper a reduction value V_reduc which the then we subtract the V_upper speed increaser to get the V_under underestimated speed as shown in Figure 2.

According to an equivalent variant in its purpose, the reduction law LR can be stored in a non-volatile memory in the form of an abacus which associates directly to each value of speed increaser V_upper an underestimated speed value V_under which takes (implicitly) into consideration the reduction value V_reduc applicable to the V_upper speed increaser considered.

Preferably, during the step (b) of estimating a speed enhancer, at a time t_n considered corresponding to a current iteration n, the V_upper (t_n) speed master is evaluated from at least a V_roue input speed measurement, such as a V_roue rotation speed measurement of a wheel 2 of the vehicle, and more preferably from the maximum rotational speed recorded among the speeds of several wheels or even of the whole of the vehicle wheels, then, according to a preferred characteristic which may constitute an entirely separate invention, the said V_upper (t_n) speed increaser is compared with the V_upper (t_n-1) speed increaser which has been evaluated at the same time. previous iteration n-1 (at a time t_n-1), in order to evaluate the corresponding variation of the V_upper speed increaser per unit of time, or, respectively, the entry speed measurement of the current iteration is compared V_roue (t_n) to the velocity measurement of trance of the previous iteration V_roue (t_n-1) in order to evaluate the corresponding variation of input speed measurement per unit of time, said variation of velocity magnifier V_upper per unit of time, respectively said variation of speed measurement input per unit time, being said "observed speed gradient" grad (V).

Then, said graded gradient gradient Grad (V) is compared to a first reference gradient, said first "maximum plausible gradient" Grad_ref_l, previously predetermined by acceleration and braking tests of the vehicle, and, if the gradient observed speed Grad (V) is, in absolute value, greater than said first maximum plausible gradient Grad_ref_l, it corrects the speed of the current iteration V_upper (t_n) by clipping, applying to the speed boost of the previous iteration V_upper (t_n-1), or respectively to the input speed measurement of the previous iteration V_roue (t_n-1), the first plausible maximum gradient Grad_ref_l instead of the observed gradient gradient Grad (V ).

In other words:

The instantaneous speed variation per unit of time is calculated:

Grad (V) = [V_upper (t_n) - V_ upper (t_n-1)] / [(t_n) - (t_n-1)] or, equivalently, the variation of input speed per unit of time:

Grad (V) = [V_roue (t_n) - V_roue (t_n-l)] / [(t_n) - (t_n-l)]

Grad (V) is then compared to Grad_ref_l. Concretely, the plausible maximum gradient Grad_ref_l represents the maximum acceleration, or respectively the maximum deceleration, that the vehicle can achieve materially, taking into account in particular the power of the engine responsible for moving the vehicle, the efficiency of the braking circuit, and the adhesion of the tires.

These maximum acceleration or maximum deceleration capacities are determined empirically by acceleration tests and deceleration tests (for example emergency braking) carried out on the vehicle, during which the vehicle is brought to its limits. adhesion in an acceleration / deceleration situation.

Where appropriate, tests on a vehicle shall establish a general plausible maximum gradient, which will be applicable to all vehicles of the same model having the same configuration.

If, in absolute value, the observed Gradient Gradient Grad (V) is greater than the maximum plausible speed gradient, i.e.

if | Grad (V) | > | Grad_ref_l | ,

this means that the measured variation of the vehicle speed, ie the measured acceleration, or respectively the measured deceleration, of the vehicle, represented by Grad (V), is greater than the maximum acceleration, respectively maximum braking, that the vehicle can physically provide, which is of course impossible.

It is therefore concluded that the estimate of the V_upper speed increaser is erroneous, in this case overvalued in the case of acceleration, underestimated in the case of braking. This error situation may occur in particular when a wheel loses traction and, as the case may be, accelerates strongly by skating on the road surface, or brakes until it locks and slides on the roadway.

In such a situation, it is then decided to substitute the plausible maximum gradient Grad_ref_l for the gradient observed Grad (V), so as to replace the erroneous speed enhancer V_upper (t_n), estimated during the current iteration n, by an upper bound of V_upper velocity calculated more plausible, that is to say which corresponds more realistically to the real possible performance of the vehicle, and which is obtained by adding to the previous value of speed increaser V_upper (t_n-1), measured during the previous iteration n-1 and considered reliable, the maximum gradient plausible Grad_ref_l multiplied by the time elapsed between the two iterations:

V_upper (t_n) = V_upper (t_n-1) + Grad_ref_l * [(t_n) - (t_n-l)] In other words, if the estimated V_upper speed factor (or collected via the CAN network) during the current t_n iteration is not realistic, because incompatible with the performance of the vehicle, it is considered arbitrarily that the instantaneous speed, and therefore the speed increaser V_upper, could not vary, with respect to the instantaneous speed, respectively with respect to the V_upper speed increaser, evaluated during the previous iteration, at most that of a value equal to that defined by the maximum acceleration capacity, or respectively by the maximum capacity of deceleration, of the vehicle.

Thus, it is ensured that the V_upper speed increaser considered to apply the method, and more particularly to implement the steps (c) of calculating V_under underestimated speed, and (d) comparison then, if (e) switching, always remains consistent with the vehicle's hardware capabilities, either directly using the estimate of said V_upper speed enhancer, if said estimate is consistent with the limit of variation set by the maximum possible gradient Grad_ref_l or, if this is not the case, by recalculating said V_upper speed increaser in the limit of variation posed by the plausible maximum gradient Grad_ref_l, to make said V_upper higher speed corresponding to said limit, and therefore coherent with the capacities the vehicle.

In practice, the clipping amounts to applying a (first) gradient limiter 3 whose saturation value SAT +, SAT- corresponds to the maximum gradient plausible Grad_ref_l.

Such a gradient limiter 3 will pass as it is any variation of V_upper speed increaser which is less than or equal to the plausible maximum gradient Grad_ref_l, that is to say which is between a zero value and the saturation value SAT +, SAT - (clipping value) defined by said plausible maximum gradient, and which is therefore consistent with the actual acceleration / deceleration capabilities of the vehicle.

On the other hand, this gradient limiter 3 will automatically limit any variation in the V_upper speed increase that exceeds said plausible maximum gradient Grad_ref_l, that is to say which exceeds, in absolute value, the absolute value of the saturation value SAT +, SAT correspondingly, by reducing (then saturating) said variation of the speed enhancer to said plausible maximum gradient value, that is to say to the saturation value SAT +, SAT-.

It will be noted that, advantageously, the gradient limiter 3 may comprise a saturation value in SAT + acceleration which is distinct, in absolute value, from the SAT deceleration saturation value (braking), that is to say operating a saturation that is not symmetrical depending on whether one is in a situation of acceleration (variation of speed, and thus variation of speed increase, positive) or deceleration (speed variation, and therefore variation of speed , negative).

Such differentiation will make it possible to take into account the fact that, materially, a vehicle can generally decelerate, especially in an emergency braking situation, with more intensity than it can accelerate.

Preferably, the (first) maximum gradient plausible Grad_ref_l, and therefore the gradient limiter 3, can thus set a saturation value in SAT + acceleration, in absolute value, at the SAT deceleration saturation value, that is, to say such as | SAT + | <| SAT- | .

By way of example, it will be possible to define an acceleration saturation value of the order of +10 km / h / second, and a saturation saturation value SAT- of the order of -36 km / h / second.

The positive and negative signs here correspond, by convention, to acceleration and respectively to deceleration.

Advantageously, this saturation of the speed gradient operated by the gradient limiter 3 makes it possible to avoid making a gross error in estimating the V_upper speed increasant when the method for estimating the longitudinal speed of the vehicle, and more particularly the method estimating speed, is faulty or inapplicable, as is the case for example when racing or blocking a wheel 2 following a loss of adhesion.

It will also be noted that the saturation effected by the first gradient limiter 3 can intervene indifferently, in an equivalent manner, either upstream, at the source, ie on the input speed measurement signals (here the signals representative of the respective rotational speeds of the wheels) V_roue, or downstream, on the result of the estimate of the "raw" speed rider V_upper_basic which comes from the speed calculation carried out on the basis of these input speed measurement signals V_roue, as shown in Figure 2.

As a variant, the saturation effected by the first gradient limiter 3 may occur downstream on an estimate of the V_upper speed increaser which comes from the recovery of an instantaneous speed signal made available to the onboard network 20.

According to one possible implementation of the invention, the switching step (e) can operate an immediate switching of the operating mode normal to the safety mode, by immediately passing the speed indicator parameter V_param from the functional speed V_func to the underrated speed V_under, as soon as it is detected that, in absolute value, the functional speed V_func becomes lower than the speed underestimated V_under.

Graphically, this amounts to switching at the point of intersection of the respective curves of the functional speed V_func and the underestimated speed V_under, as is illustrated in Figures 3 and 5A.

Such an instantaneous commutation advantageously makes it possible always to respect the limit acceptable for the security functions F2, because the indicator parameter V_param which results from it is never less than the underestimated speed V_under, and this while still being close to the functional speed V_func, favorable to the assistance functions F1, within the acceptable safety limit.

This immediate switching solution can therefore represent a good compromise for the assistance functions F1 and F2 security.

According to another implementation possibility, illustrated in FIGS.

5B, the switching step (e) can operate a delayed switching from the normal operating mode to the safety mode, by passing the speed indicator parameter V_param from the operating speed V_func to the underestimated speed V_under only if, in absolute value, the functional speed V_func remains (continuously) lower than the underestimated speed V_under during a non-zero duration, called "fault duration", which reaches or exceeds a predetermined tolerance threshold T_thresh_l.

In other words, it is thus possible to leave temporarily, for a duration T_thresh_l, the speed indicator parameter V_param follow the functional speed V_func, although said functional speed V_func is temporarily passed under the underrated speed V_under.

Advantageously, the tolerance threshold T_thresh_l makes it possible to delay the triggering of the switching, and thus to switch only in a situation of long-lasting and significant defect, that is to say only if it is really expedient to realize an adjustment of the speed indicator parameter V_param.

Thus, it avoids unnecessarily reacting to very brief and insignificant variations of the V_upper speed increaser, which may possibly result from noise or transient evaluation errors due to distorted measurements.

In addition, by temporarily maintaining the normal operating mode, without immediately triggering the safety mode, in case of faults temporary that do not compromise the safety of the vehicle, it can advantageously favor the assistance functions Fl, and thus the driving comfort.

The fault duration will be monitored by an appropriate timing, triggered when it is detected that the functional speed V_func passes under the underestimated speed V_under, so that the safety mode can be activated if the fault persists in time at the appropriate tolerance threshold T_thresh_l.

Said timing will be reset if the functional speed V_func returns to a value equal to or greater than the underestimated speed V_under.

The tolerance threshold T_thresh_l will be determined according to the fault tolerance time interval, or FTTI ("Fault Tolerance Time Interval"), which represents the maximum duration, specified by the specification, which is allowed between the occurrence of a defect (dangerous situation) and the moment or defect, and its consequences, are controlled and corrected by the power steering system 1

More particularly, the tolerance threshold T_thresh_l will be chosen strictly lower than the FTTI, so in particular to be able to include in the FTTI interval the time necessary to make the transition between the functional speed V_func and the underestimated speed V_under.

By way of example, the FFTI may be between 20 ms (twenty milliseconds) when it is associated with a very dangerous defect, threatening the safety of the occupants of the vehicle, and more than 1 s (one second) when it concerns a defect of little concern for safety.

It will be noted moreover that the refresh period of the functional speed V_func, of the speed increaser V_upper, and more generally of the speed indicator parameter V_param, that is to say the duration separating two successive iterations n-1, n of method, is preferably substantially between 5 ms (five milliseconds) and 10 ms (ten milliseconds), while the response time (typically the 5% response time) characteristic of the steering mechanism, and more generally of the vehicle, in response to a change of assistance setpoint, will generally be equal to or greater than 100 ms (hundred milliseconds), 300 ms (three hundred milliseconds), or even of the order of several seconds.

According to a preferred variant of the invention, illustrated in FIGS. 5A and 5B, the method may comprise, after the step (e) of switching, a step (f) of reinforced security, during which the duration is measured, said "safe duration", during which the security mode remains active, and, if said duration of securing reaches or exceeds a predetermined alarm threshold T_thresh_2, switching from the security mode to a third mode of operation, said enhanced security mode, by passing the vehicle speed indicator parameter V_param from the underrated speed V_under to a value referred to as the V_enhanced "enhanced security speed" which is equal to or greater than the V_upper speed increaser.

Advantageously, this variant makes it possible to diagnose a situation in which the defect, that is to say the fact that the functional speed V_func is (and remains) less than the underestimated speed V_under, lasts too long for the defect to come from simply a transient specific life situation, for example a wheel slip situation 2 in the acceleration phase.

In such a situation, there is therefore good reason to assume that the defect is the manifestation of a lasting failure of one or more vehicle systems or sensors.

This is why the enhanced safety mode is activated, in order to privilege absolutely the F2 safety functions, regardless of the actual speed of the vehicle.

The vehicle speed indicator parameter V_param is therefore forced to a reinforced safety speed value V_enhanced, possibly equal to the V_upper speed increaser applicable at the instant considered (as shown in solid lines in FIGS. 5A and 5B). , or, preferably, equal to a forcing value greater than all the possible upperances for the vehicle (as shown in dashed lines in FIGS. 5A and 5B), and therefore typically equal to or greater than the maximum possible real speed of the vehicle, so as to guarantee the effectiveness of the F2 securing functions regardless of the actual speed of the vehicle.

Preferably, the changes in the value of the vehicle speed indicator parameter V_param, which are effected during switching from one operating mode to another operating mode, and more particularly during the switching step (e) of the mode of operation normal to the security mode and / or during the step (f) of reinforced security, follow transition laws having a regularity class at least C °, such as a ramp, an interpolation function ( especially polynomial) or filtering, as can be seen in FIGS. 4 and 5B.

Such soft transitions will make it possible to ensure the continuity (at least C °) of the signal of the vehicle speed indicator parameter V_param, and thus to avoid jerky reactions of the steering system, and in particular to avoid jerks in the steering assistance.

The switching and / or transition operations are managed by a switching unit 4 placed downstream of the reduction law LR, as illustrated in FIG. 2.

This switching unit 4 can also manage the step (d) of comparison.

Preferably, according to a preferred characteristic which may constitute a fully-fledged invention, the switching step (e) may comprise a sub-step of clipping during which the rate of variation Grad (V_param) of the indicator parameter is clipped. velocity V_param by means of a second gradient limiter 5 which uses a second plausible maximum gradient Grad_ref_2, representative of a maximum acceleration or maximum deceleration that can provide the vehicle.

This second clipping is performed mutatis mutandis in a similar manner to the clipping performed by the first gradient limiter 3 described above.

In this case, it will be a question here of tolerating the variations of parameter speed indicator V_param:

Grad (V_param) = [V_param (t_n) - V_param (t_n-1)] / [(t_n) - (t_n-1)] only within limits consistent with the actual possible performance of the vehicle, as defined by the second gradient plausible maximum Grad_ref_2.

If the variations of speed indicator parameter V_param are between the saturation values SAT-, SAT + of the second gradient limiter 5, the refreshed speed indicator parameter V_param (t_n) is accepted as it is.

In the opposite case, if the variation exceeds these saturation values SAT-, SAT +, the speed indicator parameter is arbitrarily recalculated on the basis of the plausible maximum gradient Grad_ref_2:

V_param (t_n) = V_param (t_n-1) + Grad_ref_2 * [(t_n) - (t_n-1)]. This second clipping, preferably carried out downstream of the switching / transition definition phase and upstream of the assistance functions F1 and F2 securing, in particular will make it possible to avoid taking into account any inconsistent variations in the indicator parameter of V_param speed which could for example result from discontinuities induced by the switching / transition phase. This second clipping can in particular form a complementary or alternative precautionary measure to the management, from the switching stage, of continuous transitions (of regularity class C °) as described above.

Furthermore, the invention naturally relates to a power steering system 1 comprising a controller 10, of the computer type, for implementing a method of underestimation of the instantaneous speed according to the invention.

Said controller 10 will comprise for this purpose one or more electronic and / or software units, including a processing unit 11, which contains at least one underestimation unit 6 applying the reduction law LR, and preferably a comparison unit switching 4 and a second gradient limiter 5.

The controller may also include an acquisition unit 12 of V_upper speed increaser, preferably comprising a measurement unit 7 which can exploit for example as input speed V_roue the speed of one or more wheels 2 of the vehicle, and / or a first gradient limiter 3.

The controller 10 will finally comprise functional units, respectively assistance 13 and securing 14 respectively ensuring the execution of the aforementioned functions F1, F2.

The invention also relates as such to a vehicle, and in particular to a land vehicle comprising one or two driving and driving wheels 2 (preferably two driving wheels, or even an integral transmission comprising, for example, four driving wheels), equipped with such a device. power steering system 1.

Of course, the invention is in no way limited to the variants of embodiment described in the foregoing, the person skilled in the art being able in particular to isolate or freely combine the above-mentioned characteristics between them, or to substitute equivalents for them.

Claims

A method of managing a power steering system (1) for a vehicle, said power steering system having a plurality of functions including at least one assist function (F1) for assisting a driver in steering the vehicle and at least one security function (F2) intended to confer on said assistance function a predetermined ASIL level within the meaning of the ISO-26262 standard, said assistance function (F1) and said security function (F2) making each call to the same vehicle speed indicator parameter (V_param) which is considered representative of the longitudinal speed of the vehicle, said method being characterized in that it comprises a step (a) of functional speed estimation, during which it is estimated a first speed value, called "functional speed" (V_func), which is representative of the real longitudinal speed of the vehicle at a given instant. é, which is used by default as a vehicle speed indicator parameter (V_param), according to a first operating mode called "normal operating mode", a step (b) for estimating a speed increase, during which a second speed value, referred to as "velocity magnifier" (V_upper) is estimated, which is greater than the functional speed (V_func) and representative of an upper bound of the actual longitudinal velocity of the vehicle at the instant considered, a step (c) of calculating an underestimated speed during which a predetermined reduction law (LR) is applied to the velocity magnifier (V_upper) so as to obtain an underestimated speed value (V_under), which is less than the velocity magnifier (V_upper) of a predetermined reduction value (V_reduc) fixed by said reduction law (LR), a comparison step (d) during which the value of operating speed nnel (V_func) to the underestimated speed value (V_under), and, if the absolute value of the functional speed (V_func) is less than the absolute value of the underestimated speed (V_under), a step (e) switchover during which switching from the normal operating mode to a second operating mode called "safety mode", substituting the speed (V_func) the underestimated speed (V_under) as a speed indicator parameter of the vehicle (V_param) used at the input of each of the assistance and security functions (F1, F2).

2. Method according to claim 1 characterized in that the reduction law (LR) is established beforehand, by tests and / or simulations in which, at a given real longitudinal speed, non-zero, of the vehicle, it gradually lowers , and artificially, in absolute value, the indicator parameter of vehicle speed (V_param) which is taken into account by the assistance functions (F1) and of the securing function (F2), and the corresponding reactions of the securing function (F2) and / or the vehicle are observed, until to identify a low speed indicator parameter threshold (V_param_thresh_low) from which it is found that the security function (F2) is no longer able to provide a security in accordance with the desired ASIL level at the given real longitudinal speed, and then fixed, from this low speed indicator parameter threshold (V_param_thresh_low), a reduction value (V_reduc) selected for the reduction law (LR).

3. Method according to claim 1 or 2 characterized in that the reduction law (LR) adjusts the reduction value (V_reduc) as a function of the estimated speed increaser (V_upper), preferably so as to increase, in absolute value, the reduction value (V_reduc) when the speed increaser (V_upper) increases in absolute value.

4. Method according to one of the preceding claims characterized in that the reduction law (LR) is stored in a nonvolatile memory in the form of a predetermined abacus which associates with each value of speed increasant (V_upper) a value of reduction (V_reduc) which is subtracted from the velocity magnifier (V_upper) to obtain the underestimated speed (V_under), or which associates directly with each value of velocity magnifier (V_upper) an underestimated speed value (V_under) ) which takes into consideration the reduction value (V_reduc) applicable to the speed increaser (V_upper) considered.

5. Method according to one of the preceding claims characterized in that, during step (b) of estimating a speed enhancer, at a time (t_n) considered corresponding to an iteration (n) in progress, the speed increaser (V_upper (t_n)) is evaluated from at least one input speed measurement (V_roue), such as a measurement of the rotational speed of a wheel of the vehicle, and then it is compared said velocity magnifier (V_upper (t_n)) to the velocity magnifier (V_upper (t_n-1)) which was estimated during the previous iteration (n-1), in order to evaluate the corresponding variation of the velocity unit of time, or, respectively, comparing the input speed measurement of the current iteration (V_roue (t_n)) with the input speed measurement of the previous iteration (V_roue (t_n-l)) in order to evaluate the corresponding variation of input velocity measurement per unit of time, said variation of velocity enhancer per unit time, respectively said variation of measurement of input velocity per unit of time, being said "observed velocity gradient" (Grad (V)), then said observed gradient of velocity (Grad (V)) is compared with a first gradient of reference known as "maximum plausible gradient" (Grad_ref_l), predetermined beforehand by acceleration and braking tests of the vehicle, and, if the observed speed gradient (Grad (V)) is, in absolute value, greater than said plausible maximum gradient (Grad_ref_l), the speed increaser is corrected ( V_upper (t_n)) of the current iteration by clipping, by applying to the speed enhancer (V_upper (t_n-1)) of the previous iteration, or respectively to the input speed measurement of the previous iteration ( V_roue (t_n-l)), the maximum plausible gradient upstream (Grad_ref_l) instead of the observed speed gradient (Grad (V)).

6. Method according to one of the preceding claims characterized in that the switching step (e) operates an immediate switching from the normal operating mode to the safety mode, by immediately passing the speed indicator parameter (V_param) of the functional speed (V_func) at the underestimated speed (V_under), as soon as it is detected that, in absolute value, the functional speed (V_func) becomes lower than the underestimated speed (V_under).

7. Method according to one of claims 1 to 5 characterized in that the switching step (e) operates a delayed switching from the normal operating mode to the safety mode, by passing the speed indicator parameter (V_param) of the functional speed (V_func) at the underestimated speed (V_under) only if, in absolute value, the functional speed (V_func) remains lower than the underestimated speed (V_under) during a non-zero duration, called the "defect duration" Which meets or exceeds a predetermined tolerance level.

8. Method according to one of the preceding claims characterized in that it comprises, after the step (e) switching, a step (f) reinforced security, during which the duration is measured, called "duration of "security mode", during which the security mode remains active, and if said duration of security reaches or exceeds a predetermined warning threshold, switching from the security mode to a third mode of operation, said enhanced security mode, by making to pass the vehicle speed indicator parameter (V_param) of the underestimated speed (V_under) to a value called "enhanced safety speed" (V_enhanced) which is equal to or higher than the speed increaser (V_upper).

9. Method according to one of the preceding claims characterized in that the changes in the value of the vehicle speed indicator parameter (V_param), which are operated during switching from one operating mode to another operating mode, follow transition laws having a continuity class of at least C0, such as a ramp, an interpolation function or a filtering.

10. Method according to claim 6 or claim 7, characterized in that the switching step (e) comprises a substep of clipping during which the rate of variation (Grad (V_param)) of the indicator parameter is clipped. velocity sensor (V_param) by means of a second gradient limiter (5) which uses a second plausible maximum gradient (Grad_ref_2) representative of maximum acceleration or maximum deceleration that the vehicle can provide.

11. The method as claimed in one of the preceding claims, characterized in that the security function (F2) guarantees an ASIL level at least equal to B, preferably at least equal to C, or even equal to D in the sense of the ISO standard. 26262.

12. A power steering system (1) comprising a controller (10) for carrying out a method according to any one of claims 1 to 11.